Skip Links

Network World

  • Social Web 
  • Email 
  • Close
    Send to a friend          Feedback

Windows' big bug watcher

Russ Cooper, moderator of the much-followed NTBugtraq mailing list, has earned widespread respect for his unbiased disclosures.
By Ellen Messmer , Network World , 12/22/2003

NTBugtraq, the Internet equivalent of a watering hole, is a forum for swapping information on suspected bugs in Microsoft products or getting an early warning about computer worms. Now entering its sixth year, NTBugtraq has become the mailing list for IT managers and vendors who need to read the latest dispatches from the Microsoft security warfront.

"It's very much considered the No. 1 channel for contributing and looking for new updates and information on vulnerabilities," says Firas Raouf, COO at eEye Digital Security, a maker of scanning products. "NTBugtraq is a very critical, fundamental and helpful tool in facilitating the concept of full disclosure on vulnerabilities as they emerge."

If NTBugtraq seems free of the kind of wild-eyed ranting that might afflict any public list about Microsoft, it's because NTBugtraq's founder and moderator, Russ Cooper, is picky about what gets posted on it.

"It has to pass the sniff test," notes Cooper, a Lindsay, Ontario, resident who lives in a countryside house that - in addition to his family, four dogs and a cat - holds a dozen PCs and servers loaded with Microsoft software and testing tools. A 100-mile T-1 line connects Cooper's wilderness outpost to the ISP UUNet in Toronto. The pulsing heart of NTBugtraq is a Chicago-based list-mail server - donated by software vendor L-Soft - that handles mail distribution for about 31,000 NTBugtraq subscribers.

About three-quarters of the messages Cooper gets don't get posted because they fail to "stay on track and to the point," he says. But he does answer a lot of this mail on his own. "If someone says, 'I just discovered a new vulnerability,' well, I'll try to test it first. If the claim looks reasonable, I'll accept it at face value," he adds.

Disclosing Microsoft software vulnerabilities is "a touchy subject," Raouf points out. "Russ is doing a tremendous job in maintaining a level of neutrality."

Cooper's enduring reputation for fair-handedness is all the more remarkable considering risk management vendor TruSecure has owned NTBugtraq since buying the list from him three years ago, for an undisclosed sum. Cooper is now officially TruSecure's "surgeon general" - a title he picked himself, recalling a news story published four years ago that said his work at NTBugtraq made him seem like the "surgeon general of the Internet."

Partner Content

Brilliantly simple security and control solutions for email, web and endpoint

www.sophos.com

Stopping data leakage

Learn how to exploit your current security investment to control the information that flows into, through and out of your network.

Download the white paper.

Why detection rates aren't enough

Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask to prospective vendors to get the right endpoint solution.

Download the white paper.

Unauthorized applications: Taking back control

Employees installing and using unauthorized applications like IM, VoIP, games and peer-to-peer file-sharing applications cause many businesses serious concern. How do you control these applications?

Download the white paper.

Comment
Login
Forgot your account info?
Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed
Get instant email notification when white papers, webcasts, executive guides are added to our library. Stay informed and up-to-date with the latest on IT Technologies with Network World's Resource Alerts.

Whitepapers

Advancing the Economics of Networking

Aging network systems and old habits have dictated how businesses spend their IT budgets. As a...

Implementing HA at the Enterprise Data Center Edge to Connect to a Large Number of Branch Offices

This paper reviews the problem of creating a network where the dynamic availability of services is...

Enterprise Data Center Network Reference Architecture

Using a High Performance Network Backbone to Meet the Requirements of the Modern Enterprise Data...

Webcasts

PoE Plus: Impact on the PoE Market

The standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...

Harnessing the power of communications to increase workplace performance

Due to the convergence of IT and telecommunications technologies, the business workplace has been...

Stay out of the headlines: Detecting and preventing network intrusions

How do YOU stay out of the headlines? There is no denying that risk exists in our computer-driven...

Special Reports

The Evolution of Network Security

We have so many holes punched in our firewalls today that many industry insiders question the value...

IP address management in 2008 - six things to know

Read this Network World Special Brief to learn how Enterprise IT managers must update their...

The self-managed network

We aren't there yet, but advances in network and systems management tools are making it possible to...